<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8"/>
<meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1" />
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/>
<meta name="browsermode" content="application">
<meta name="apple-touch-fullscreen" content="yes">
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-title" content="Axojhf的博客">
<meta name="apple-mobile-web-app-status-bar-style" content="default">
<meta name="msapplication-navbutton-color" content="#666666">
<meta name= "format-detection" content="telephone=no" />





  <meta name="keywords" content="Writeup, nlvi" />


<link rel="apple-touch-startup-image" media="(device-width: 375px)" href="assets/apple-launch-1125x2436.png">
<link rel="apple-touch-startup-image" media="(orientation: landscape)" href="assets/apple-touch-startup-image-2048x1496.png">

<link rel="stylesheet" href="/blog/style/style.css">

<script>
  var nlviconfig = {
    title: "Axojhf的博客",
    author: "Axojhf",
    baseUrl: "/blog/",
    theme: {
      scheme: "banderole",
      lightbox: true,
      animate: true,
      search: true,
      friends: false,
      reward: false,
      pjax: false,
      lazy: false,
      toc: true
    }
  }
</script>




    
<link rel="stylesheet" href="/blog/script/lib/lightbox/css/lightbox.min.css">





    
<link rel="stylesheet" href="/blog/syuanpi/syuanpi.min.css">
















<style>
@font-face {
  font-family: "Allura";
  src: url('/blog/font/allura/allura.ttf');
}
</style>

  <title> CISCN2020初赛个人Writeup · Axojhf的博客 </title>
<meta name="generator" content="Hexo 4.2.1"></head>
<body>
  <div class="container">
    <header class="header" id="header">
  <div class="header-wrapper">
    <div class="logo">
  <div class="logo-inner syuanpi tvIn" style="display:none;">
    <h1><a href="/blog/">Axojhf的博客</a></h1>
    
  </div>
</div>

    <nav class="main-nav">
  
  <ul class="main-nav-list syuanpi tvIn">
  
    <li class="menu-item">
      <a href="javascript:;" id="search-btn" aria-label="Search">
        <i class="iconfont icon-search"></i>
      </a>
    </li>
  
  
  
    
  
    <li class="menu-item">
      <a href="/blog/" id="article">
        <span class="base-name">
          
            ARTICLE
          
        </span>
      </a>
    </li>
  
  
    
  
    <li class="menu-item">
      <a href="/blog/archives" id="archives">
        <span class="base-name">
          
            ARCHIVES
          
        </span>
      </a>
    </li>
  
  
    
  
    <li class="menu-item">
      <a href="javascript:;" id="tags">
        <span class="base-name">
          
            TAGS
          
        </span>
      </a>
    </li>
  
  
    
  
    <li class="menu-item">
      <a href="/blog/about" id="about">
        <span class="base-name">
          
            ABOUT
          
        </span>
      </a>
    </li>
  
  
  </ul>
  
</nav>

  </div>
</header>
<div class="mobile-header" id="mobile-header">
  <div class="mobile-header-nav">
    <div class="mobile-header-item" id="mobile-left">
      <div class="header-menu-item">
        <div class="header-menu-line"></div>
      </div>
    </div>
    <h1 class="mobile-header-title">
      <a href="/">Axojhf的博客</a>
    </h1>
    <div class="mobile-header-item"></div>
  </div>
  <div class="mobile-header-body">
    <ul class="mobile-header-list">
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-0">
          <a href="/blog/" >
            
              ARTICLE
            
          </a>
        </li>
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-1">
          <a href="/blog/archives" >
            
              ARCHIVES
            
          </a>
        </li>
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-2">
          <a href="javascript:;" id="mobile-tags">
            
              TAGS
            
          </a>
        </li>
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-3">
          <a href="/blog/about" >
            
              ABOUT
            
          </a>
        </li>
      
    </ul>
  </div>
</div>



    <div class="container-inner" style="display:none;">
      <main class="main" id="main">
        <div class="main-wrapper">
          
    
  
  <article class="
  post
   is_post 
  ">
    <header class="post-header">
      <div class="post-time syuanpi fadeInRightShort back-1">
        <div class="post-time-wrapper">
          
          <time>2020-08-24</time>
          
        </div>
      </div>
      <h2 class="post-title syuanpi fadeInRightShort back-2">
        
          CISCN2020初赛个人Writeup
        
      </h2>
    </header>
    <div class="post-content syuanpi fadeInRightShort back-3">
      
        <p>(本篇文章只记录博主个人做题的Writeup，博主还是菜鸟，有些知识可能理解不够透彻，有些表述可能不够严谨，欢迎大家指正，望大家多多包涵)</p>
<a id="more"></a>

<h2 id="babyjsc"><a href="#babyjsc" class="headerlink" title="babyjsc"></a>babyjsc</h2><p>重点在<code>server.py</code>文件：</p>
<p><img src="image-20200821094942030.png" alt="image-20200821094942030"></p>
<p>很明显，在文件的开头部分有一个<code>input</code>函数，要知道，这个函数不同于一般的输入函数，它是期望你输入一个python表达式的，也就是说，如过我执行这个<code>server.py</code>文件，那么我就可以通过对inputs函数的输入而达到控制脚本的执行的目的。以为这是猜测，所以还需要看靶机上是不是真的运行着这个python文件：</p>
<p><img src="image-20200821095632101.png" alt="image-20200821095632101"></p>
<p>很明显，我输入a之后这个脚本就报错了。</p>
<p>因为我的最终目的是获得<code>server.py</code>同目录下的flag文件的值，而从前面这张图片可以看出flag文件的绝对地址在<code>/home/ctf/flag</code>，要想获得flag，最简单的方法是执行<code>cat /home/ctf/flag</code>命令，因为原脚本已经导入了os包，所以我们直接发送<code>os.system(&quot;cat /home/ctf/flag&quot;)</code>即可</p>
<h2 id="z3"><a href="#z3" class="headerlink" title="z3"></a>z3</h2><p>直接拉进IDA里分析，修改，重新命名反编译的代码后可以看到这样的代码：</p>
<p><img src="image-20200821102804150.png" alt="image-20200821102804150"></p>
<p>很明显，这一串代码具有周期性<code>Dst</code>数组是拷贝了<code>0x404020</code>处168个字节，而输入的字符串分布在<code>v10~v15</code>数组中。由代码尾部的循环可知，<code>v4~v9</code>数组与<code>Dst</code>数组是相同的，而上图算得<code>v4~v9</code>数组的形式像线性方程组，所以可以通过解线性方程组来解题。</p>
<p>这里0x404020提取出来的数据是这样的：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="string">"\x17\x4F\x00\x00\xF6\x9C\x00\x00\xDB\x8D\x00\x00\xA6\x8E\x00\x00\x29\x69\x00\x00\x11\x99\x00\x00\xA2\x40\x00\x00\x3E\x2F\x00\x00\xB6\x62\x00\x00\x82\x4B\x00\x00\x6C\x48\x00\x00\x02\x40\x00\x00\xD7\x52\x00\x00\xEF\x2D\x00\x00\xDC\x28\x00\x00\x0D\x64\x00\x00\x8F\x52\x00\x00\x3B\x61\x00\x00\x81\x47\x00\x00\x17\x6B\x00\x00\x37\x32\x00\x00\x93\x2A\x00\x00\x5F\x61\x00\x00\xBE\x50\x00\x00\x8E\x59\x00\x00\x56\x46\x00\x00\x31\x5B\x00\x00\x3A\x31\x00\x00\x10\x30\x00\x00\xFE\x67\x00\x00\x5F\x4D\x00\x00\xDB\x58\x00\x00\x99\x37\x00\x00\xA0\x60\x00\x00\x50\x27\x00\x00\x59\x37\x00\x00\x53\x89\x00\x00\x22\x71\x00\x00\xF9\x81\x00\x00\x24\x55\x00\x00\x71\x89\x00\x00\x1D\x3A\x00\x00"</span></span><br></pre></td></tr></table></figure>

<p>这里写出一个c程序得到42个<code>int</code>类型的值，并7个一分组：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdio.h&gt;</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;stdint.h&gt;</span></span></span><br><span class="line"></span><br><span class="line"><span class="keyword">char</span> Dst[] = <span class="string">"\x17\x4F\x00\x00\xF6\x9C\x00\x00\xDB\x8D\x00\x00\xA6\x8E\x00\x00\x29\x69\x00\x00\x11\x99\x00\x00\xA2\x40\x00\x00\x3E\x2F\x00\x00\xB6\x62\x00\x00\x82\x4B\x00\x00\x6C\x48\x00\x00\x02\x40\x00\x00\xD7\x52\x00\x00\xEF\x2D\x00\x00\xDC\x28\x00\x00\x0D\x64\x00\x00\x8F\x52\x00\x00\x3B\x61\x00\x00\x81\x47\x00\x00\x17\x6B\x00\x00\x37\x32\x00\x00\x93\x2A\x00\x00\x5F\x61\x00\x00\xBE\x50\x00\x00\x8E\x59\x00\x00\x56\x46\x00\x00\x31\x5B\x00\x00\x3A\x31\x00\x00\x10\x30\x00\x00\xFE\x67\x00\x00\x5F\x4D\x00\x00\xDB\x58\x00\x00\x99\x37\x00\x00\xA0\x60\x00\x00\x50\x27\x00\x00\x59\x37\x00\x00\x53\x89\x00\x00\x22\x71\x00\x00\xF9\x81\x00\x00\x24\x55\x00\x00\x71\x89\x00\x00\x1D\x3A\x00\x00"</span>;</span><br><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">main</span><span class="params">(<span class="keyword">void</span>)</span></span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">	<span class="keyword">uint32_t</span> *a = &amp;Dst;</span><br><span class="line">	<span class="keyword">for</span> (<span class="keyword">int</span> i = <span class="number">0</span>; i &lt; <span class="number">42</span>; ++i)</span><br><span class="line">	&#123;</span><br><span class="line">		<span class="keyword">if</span> (i % <span class="number">7</span> == <span class="number">0</span> &amp;&amp; <span class="number">0</span> != i)</span><br><span class="line">			<span class="built_in">putchar</span>(<span class="string">'\n'</span>);</span><br><span class="line">		<span class="built_in">printf</span>(<span class="string">"%d,"</span>, a[i]);</span><br><span class="line">	&#125;</span><br><span class="line">	<span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>由于v4，v5，v6，v7，v8，v9数组对应的系数矩阵是一样的，所以工作量大大减轻了。</p>
<p>这里使用python的numpy解线性方程组：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> numpy <span class="keyword">as</span> np</span><br><span class="line"><span class="keyword">import</span> re</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">calc</span><span class="params">(b_str)</span>:</span></span><br><span class="line">    a = np.zeros(shape=(<span class="number">7</span>, <span class="number">7</span>))</span><br><span class="line">    b = np.mat(b_str).T</span><br><span class="line">    a[<span class="number">0</span>][<span class="number">3</span>] = <span class="number">34</span></span><br><span class="line">    a[<span class="number">0</span>][<span class="number">0</span>] = <span class="number">12</span></span><br><span class="line">    a[<span class="number">0</span>][<span class="number">1</span>] = <span class="number">53</span></span><br><span class="line">    a[<span class="number">0</span>][<span class="number">2</span>] = <span class="number">6</span></span><br><span class="line">    a[<span class="number">0</span>][<span class="number">4</span>] = <span class="number">58</span></span><br><span class="line">    a[<span class="number">0</span>][<span class="number">5</span>] = <span class="number">36</span></span><br><span class="line">    a[<span class="number">0</span>][<span class="number">6</span>] = <span class="number">1</span></span><br><span class="line"></span><br><span class="line">    a[<span class="number">1</span>][<span class="number">4</span>] = <span class="number">27</span></span><br><span class="line">    a[<span class="number">1</span>][<span class="number">3</span>] = <span class="number">73</span></span><br><span class="line">    a[<span class="number">1</span>][<span class="number">2</span>] = <span class="number">12</span></span><br><span class="line">    a[<span class="number">1</span>][<span class="number">0</span>] = <span class="number">83</span></span><br><span class="line">    a[<span class="number">1</span>][<span class="number">1</span>] = <span class="number">85</span></span><br><span class="line">    a[<span class="number">1</span>][<span class="number">5</span>] = <span class="number">96</span></span><br><span class="line">    a[<span class="number">1</span>][<span class="number">6</span>] = <span class="number">52</span></span><br><span class="line"></span><br><span class="line">    a[<span class="number">2</span>][<span class="number">2</span>] = <span class="number">24</span></span><br><span class="line">    a[<span class="number">2</span>][<span class="number">0</span>] = <span class="number">78</span></span><br><span class="line">    a[<span class="number">2</span>][<span class="number">1</span>] = <span class="number">53</span></span><br><span class="line">    a[<span class="number">2</span>][<span class="number">3</span>] = <span class="number">36</span></span><br><span class="line">    a[<span class="number">2</span>][<span class="number">4</span>] = <span class="number">86</span></span><br><span class="line">    a[<span class="number">2</span>][<span class="number">5</span>] = <span class="number">25</span></span><br><span class="line">    a[<span class="number">2</span>][<span class="number">6</span>] = <span class="number">46</span></span><br><span class="line"></span><br><span class="line">    a[<span class="number">3</span>][<span class="number">1</span>] = <span class="number">78</span></span><br><span class="line">    a[<span class="number">3</span>][<span class="number">0</span>] = <span class="number">39</span></span><br><span class="line">    a[<span class="number">3</span>][<span class="number">2</span>] = <span class="number">52</span></span><br><span class="line">    a[<span class="number">3</span>][<span class="number">3</span>] = <span class="number">9</span></span><br><span class="line">    a[<span class="number">3</span>][<span class="number">4</span>] = <span class="number">62</span></span><br><span class="line">    a[<span class="number">3</span>][<span class="number">5</span>] = <span class="number">37</span></span><br><span class="line">    a[<span class="number">3</span>][<span class="number">6</span>] = <span class="number">84</span></span><br><span class="line"></span><br><span class="line">    a[<span class="number">4</span>][<span class="number">4</span>] = <span class="number">48</span></span><br><span class="line">    a[<span class="number">4</span>][<span class="number">2</span>] = <span class="number">14</span></span><br><span class="line">    a[<span class="number">4</span>][<span class="number">0</span>] = <span class="number">23</span></span><br><span class="line">    a[<span class="number">4</span>][<span class="number">1</span>] = <span class="number">6</span></span><br><span class="line">    a[<span class="number">4</span>][<span class="number">3</span>] = <span class="number">74</span></span><br><span class="line">    a[<span class="number">4</span>][<span class="number">5</span>] = <span class="number">12</span></span><br><span class="line">    a[<span class="number">4</span>][<span class="number">6</span>] = <span class="number">83</span></span><br><span class="line"></span><br><span class="line">    a[<span class="number">5</span>][<span class="number">5</span>] = <span class="number">15</span></span><br><span class="line">    a[<span class="number">5</span>][<span class="number">4</span>] = <span class="number">48</span></span><br><span class="line">    a[<span class="number">5</span>][<span class="number">2</span>] = <span class="number">92</span></span><br><span class="line">    a[<span class="number">5</span>][<span class="number">1</span>] = <span class="number">85</span></span><br><span class="line">    a[<span class="number">5</span>][<span class="number">0</span>] = <span class="number">27</span></span><br><span class="line">    a[<span class="number">5</span>][<span class="number">3</span>] = <span class="number">42</span></span><br><span class="line">    a[<span class="number">5</span>][<span class="number">6</span>] = <span class="number">72</span></span><br><span class="line"></span><br><span class="line">    a[<span class="number">6</span>][<span class="number">5</span>] = <span class="number">26</span></span><br><span class="line">    a[<span class="number">6</span>][<span class="number">3</span>] = <span class="number">67</span></span><br><span class="line">    a[<span class="number">6</span>][<span class="number">1</span>] = <span class="number">6</span></span><br><span class="line">    a[<span class="number">6</span>][<span class="number">0</span>] = <span class="number">4</span></span><br><span class="line">    a[<span class="number">6</span>][<span class="number">2</span>] = <span class="number">3</span></span><br><span class="line">    a[<span class="number">6</span>][<span class="number">6</span>] = <span class="number">68</span></span><br><span class="line"></span><br><span class="line">    r = np.linalg.solve(a, b)</span><br><span class="line">    list1 = re.findall(<span class="string">r'\d&#123;1,3&#125;(?=.)'</span>, str(r.T))</span><br><span class="line">    <span class="keyword">for</span> x <span class="keyword">in</span> list1:</span><br><span class="line">        print(chr(int(x)),end=<span class="string">''</span>)</span><br><span class="line"></span><br><span class="line">calc(<span class="string">'20247,40182,36315,36518,26921,39185,16546'</span>)</span><br><span class="line">calc(<span class="string">'12094,25270,19330,18540,16386,21207,11759'</span>)</span><br><span class="line">calc(<span class="string">'10460,25613,21135,24891,18305,27415,12855'</span>)</span><br><span class="line">calc(<span class="string">'10899,24927,20670,22926,18006,23345,12602'</span>)</span><br><span class="line">calc(<span class="string">'12304,26622,19807,22747,14233,24736,10064'</span>)</span><br><span class="line">calc(<span class="string">'14169,35155,28962,33273,21796,35185,14877'</span>)</span><br></pre></td></tr></table></figure>

<h2 id="hyperthreading"><a href="#hyperthreading" class="headerlink" title="hyperthreading"></a>hyperthreading</h2><p>使用x86dbg打开程序，一直按F8步过，发现在这个位置可以输入了：</p>
<p><img src="image-20200821111927157.png" alt="image-20200821111927157"></p>
<p>这里我们根据末尾的0x270在IDA上找到了目标函数：</p>
<p><img src="image-20200821112112822.png" alt="image-20200821112112822"></p>
<p>很明显需要输入42个字符，应该是最终的flag，之后创建了三个线程，第一个指向的地址的下方有这些IDA分析不了的代码：</p>
<p><img src="image-20200821112344433.png" alt="image-20200821112344433"></p>
<p>其中用到了<code>byte_40336C</code>的地址正是我们输入字符串的地址，由于<code>sub_401270</code>函数会直接比较<code>byte_40336C</code>与字符串<code>byte_402150</code>，所以这里很可能是处理输入字符串的地方。</p>
<p>因为创建的第三个线程使用了<code>IsDebuggerPresent()</code>函数来检测是否正在进行调试，所以我决定讲断点打在尾部为<code>0x1120</code>的地方，方便对修改<code>byte_40336C</code>的函数进行解析。</p>
<p>然后就可以看到0x401153里没有被解析的部分的汇编代码。稍微调试，阅读一下代码就知道它是这样修改每个字符的：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">(((((x&gt;&gt;<span class="number">2</span>)^(x&lt;&lt;<span class="number">6</span>))&amp;<span class="number">0xff</span>)^<span class="number">0x23</span>)+<span class="number">0x23</span>)&amp;<span class="number">0xff</span></span><br></pre></td></tr></table></figure>

<p>（上文的汇编代码中有<code>shl ecx,6</code>这个本来是算术左移，但是由于操作的数据一般不大于0xffff，其实使用逻辑左移也可以）</p>
<p>这样我们知道了对应关系，但是这个过程应该是不可逆的，所以需要我们自己遍历可见字符去爆破出flag。</p>
<p>解题脚本：</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">s = <span class="string">'\xDD\x5B\x9E\x1D\x20\x9E\x90\x91\x90\x90\x91\x92\xDE\x8B\x11\xD1\x1E\x9E\x8B\x51\x11\x50\x51\x8B\x9E\x5D\x5D\x11\x8B\x90\x12\x91\x50\x12\xD2\x91\x92\x1E\x9E\x90\xD2\x9F'</span></span><br><span class="line"><span class="keyword">for</span> l <span class="keyword">in</span> s:</span><br><span class="line">	<span class="keyword">for</span> x <span class="keyword">in</span> range(<span class="number">0</span>,<span class="number">256</span>):</span><br><span class="line">		<span class="keyword">if</span> (((((x&gt;&gt;<span class="number">2</span>)^(x&lt;&lt;<span class="number">6</span>))&amp;<span class="number">0xff</span>)^<span class="number">0x23</span>)+<span class="number">0x23</span>)&amp;<span class="number">0xff</span> == ord(l):</span><br><span class="line">			print(chr(x),end=<span class="string">''</span>)</span><br></pre></td></tr></table></figure>

<p>（字符串s是从<code>byte_402150</code>位置导出来的）</p>

      
    
    </div>
    
      <div class="post-tags syuanpi fadeInRightShort back-3">
      
        <a href="/blog/tags/Writeup/">Writeup</a>
      
      </div>
    
    
      

      
  <hr class="copy-line">
  <div class="post-copyright">
    <div class="copy-author">
      <span>作者 :</span>
      <span>Axojhf</span>
    </div>
    <div class="copy-url">
      <span>地址 :</span>
      <a href="http://xiaoaoaode.gitee.io/blog/2020/08/24/49582296/">http://xiaoaoaode.gitee.io/blog/2020/08/24/49582296/</a>
    </div>
    <div class="copy-origin">
      <span>来源 :</span>
      <a href="http://xiaoaoaode.gitee.io/blog">http://xiaoaoaode.gitee.io/blog</a>
    </div>
    <div class="copy-license">
      
      著作权归作者所有，转载请联系作者获得授权。
    </div>
  </div>

    
  </article>
  
    
  <nav class="article-page">
    
      <a href="/blog/2020/08/31/2253bdbe/" id="art-left" class="art-left">
        <span class="next-title">
          <i class="iconfont icon-left"></i>DASCTF2020八月赛个人Writeup
        </span>
      </a>
    
    
      <a href="/blog/2020/08/19/5276656a/" id="art-right" class="art-right">
        <span class="prev-title">
          BUUCTF-Pwn题-Writeup（5）<i class="iconfont icon-right"></i>
        </span>
      </a>
    
  </nav>


    
  <i id="com-switch" class="iconfont icon-down jumping-in long infinite" style="font-size:24px;display:block;text-align:center;transform:rotate(180deg);"></i>
  <div class="post-comments" id="post-comments" style="display: block;margin: auto 16px;">
    

    
    

    

  </div>



  
  
    
  
  <aside class="post-toc">
    <div class="title"><span>文章导航</span></div>
    <div class="toc-inner">
      <ol class="toc"><li class="toc-item toc-level-2"><a class="toc-link" href="#babyjsc"><span class="toc-text">babyjsc</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#z3"><span class="toc-text">z3</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#hyperthreading"><span class="toc-text">hyperthreading</span></a></li></ol>
    </div>
  </aside>



  


        </div>
      </main>
      <footer class="footer syuanpi fadeIn" id="footer">
  <hr>
  <div class="footer-wrapper">
    <div class="left">
      <div class="contact-icon">
  
  
</div>

    </div>
    <div class="right">
      <div class="copyright">
    <div class="info">
        <span>&copy;</span>
        <span>2020 ~ 2020</span>
        <span>❤</span>
        <span>Axojhf</span>
    </div>
    <div class="theme">
        <span>
            动力来源于
            <a href="http://hexo.io/" target="_blank" rel="noopener">Hexo </a>
        </span>
        <span>
            主题
            <a href="https://github.com/ColMugX/hexo-theme-Nlvi" target="_blank" rel="noopener"> Nlvi </a>
        </span>
    </div>
    
</div>

    </div>
  </div>
</footer>
    </div>
    <div class="tagcloud" id="tagcloud">
  <div class="tagcloud-taglist">
  
    <div class="tagcloud-tag">
      <button>Writeup</button>
    </div>
  
    <div class="tagcloud-tag">
      <button>其他</button>
    </div>
  
    <div class="tagcloud-tag">
      <button>知识点记录</button>
    </div>
  
  </div>
  
    <div class="tagcloud-postlist active">
      <h2>Writeup</h2>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/27/dd14f23d/">
            <time class="tagcloud-posttime">2020 / 07 / 27</time>
            <span>BUUCTF-Pwn题-Writeup（1）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/28/cfa15dd3/">
            <time class="tagcloud-posttime">2020 / 07 / 28</time>
            <span>BUUCTF-Pwn题-Writeup（2）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/16/771d3ab6/">
            <time class="tagcloud-posttime">2020 / 08 / 16</time>
            <span>BUUCTF-Pwn题-Writeup（3）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/19/5276656a/">
            <time class="tagcloud-posttime">2020 / 08 / 19</time>
            <span>BUUCTF-Pwn题-Writeup（5）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/17/eaca020f/">
            <time class="tagcloud-posttime">2020 / 08 / 17</time>
            <span>BUUCTF-Pwn题-Writeup（4）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/09/21/f87fade1/">
            <time class="tagcloud-posttime">2020 / 09 / 21</time>
            <span>BUUCTF-Pwn题-Writeup（7）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/09/04/40c3ca84/">
            <time class="tagcloud-posttime">2020 / 09 / 04</time>
            <span>BUUCTF-Pwn题-Writeup（6）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/09/28/a01cbdb7/">
            <time class="tagcloud-posttime">2020 / 09 / 28</time>
            <span>BUUCTF-Pwn题-Writeup（8）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/31/2253bdbe/">
            <time class="tagcloud-posttime">2020 / 08 / 31</time>
            <span>DASCTF2020八月赛个人Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/26/253f1adb/">
            <time class="tagcloud-posttime">2020 / 07 / 26</time>
            <span>DASCTF七月赛个人Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/24/49582296/">
            <time class="tagcloud-posttime">2020 / 08 / 24</time>
            <span>CISCN2020初赛个人Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/01/14185/">
            <time class="tagcloud-posttime">2020 / 06 / 01</time>
            <span>我写出来的招新题的Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/17/45ae5a23/">
            <time class="tagcloud-posttime">2020 / 06 / 17</time>
            <span>攻防世界-“250”题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/09/7b438d60/">
            <time class="tagcloud-posttime">2020 / 06 / 09</time>
            <span>攻防世界-babyheap题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/17/47cfb24f/">
            <time class="tagcloud-posttime">2020 / 06 / 17</time>
            <span>攻防世界-“Recho”题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/12/e563c85c/">
            <time class="tagcloud-posttime">2020 / 07 / 12</time>
            <span>攻防世界-magic题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/10/07/9b619749/">
            <time class="tagcloud-posttime">2020 / 10 / 07</time>
            <span>攻防世界-nobug题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/02/471a08d2/">
            <time class="tagcloud-posttime">2020 / 06 / 02</time>
            <span>攻防世界--supermarket题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/10/04/77eb8480/">
            <time class="tagcloud-posttime">2020 / 10 / 04</time>
            <span>攻防世界-onemanarmy题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/02/a54507f8/">
            <time class="tagcloud-posttime">2020 / 06 / 02</time>
            <span>攻防世界——dice_game题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/10/928398a1/">
            <time class="tagcloud-posttime">2020 / 06 / 10</time>
            <span>攻防世界-"实时数据监测"题Writeup</span>
          </a>
        </div>
      
    </div>
  
    <div class="tagcloud-postlist ">
      <h2>其他</h2>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/07/38a4c9bb/">
            <time class="tagcloud-posttime">2020 / 08 / 07</time>
            <span>Pwn环境的搭建和解答一些简单Pwn题的分享</span>
          </a>
        </div>
      
    </div>
  
    <div class="tagcloud-postlist ">
      <h2>知识点记录</h2>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/10/44355a63/">
            <time class="tagcloud-posttime">2020 / 08 / 10</time>
            <span>_IO_FILE结构与fread函数知识点小结</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/01/8e1ab4ab/">
            <time class="tagcloud-posttime">2020 / 08 / 01</time>
            <span>Pwn题里有关seccomp和prctl函数的知识点小结</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/19/5cfa9d84/">
            <time class="tagcloud-posttime">2020 / 07 / 19</time>
            <span>正则表达式学习1</span>
          </a>
        </div>
      
    </div>
  
</div>

  </div>
  <div class="backtop syuanpi melt toTop" id="backtop">
    <i class="iconfont icon-up"></i>
    <span style="text-align:center;font-family:Georgia;"><span style="font-family:Georgia;" id="scrollpercent">1</span>%</span>
</div>

  <div class="search" id="search">
    <div class="input">
      <input type="text" id="search-input" placeholder="搜索一下？" autofocus>
    </div>
    <div id="search-result"></div>
  </div>



<script src="https://cdn.jsdelivr.net/npm/jquery@3.4.1/dist/jquery.min.js"></script>



  <script></script>
  <script src="/blog/script/lib/lightbox/js/lightbox.min.js" async></script>











  
<script src="/blog/script/scheme/banderole.js"></script>




<script src="/blog/script/bootstarp.js"></script>



<script>
if (nlviconfig.theme.toc) {
  setTimeout(function() {
    if (nlviconfig.theme.scheme === 'balance') {
      $("#header").addClass("show_toc");
    } else if (nlviconfig.theme.scheme === 'banderole') {
      $(".container-inner").addClass("has_toc");
      $(".post-toc .title").addClass("show");
      $(".toc-inner").addClass("show");
    }
  }, 1000);
}
</script>



</body>
</html>
